##// END OF EJS Templates
upstream » mercurial-mirror
RSS

Clone from https://www.mercurial-scm.org/repo/hg-all

hgweb: support Content Security Policy...
hgweb: support Content Security Policy Content-Security-Policy (CSP) is a web security feature that allows servers to declare what loaded content is allowed to do. For example, a policy can prevent loading of images, JavaScript, CSS, etc unless the source of that content is whitelisted (by hostname, URI scheme, hashes of content, etc). It's a nifty security feature that provides extra mitigation against some attacks, notably XSS. Mitigation against these attacks is important for Mercurial because hgweb renders repository data, which is commonly untrusted. While we make attempts to escape things, etc, there's the possibility that malicious data could be injected into the site content. If this happens today, the full power of the web browser is available to that malicious content. A restrictive CSP policy (defined by the server operator and sent in an HTTP header which is outside the control of malicious content), could restrict browser capabilities and mitigate security problems posed by malicious data. CSP works by emitting an HTTP header declaring the policy that browsers should apply. Ideally, this header would be emitted by a layer above Mercurial (likely the HTTP server doing the WSGI "proxying"). This works for some CSP policies, but not all. For example, policies to allow inline JavaScript may require setting a "nonce" attribute on <script>. This attribute value must be unique and non-guessable. And, the value must be present in the HTTP header and the HTML body. This means that coordinating the value between Mercurial and another HTTP server could be difficult: it is much easier to generate and emit the nonce in a central location. This commit introduces support for emitting a Content-Security-Policy header from hgweb. A config option defines the header value. If present, the header is emitted. A special "%nonce%" syntax in the value triggers generation of a nonce and inclusion in <script> elements in templates. The inclusion of a nonce does not occur unless "%nonce%" is present. This makes this commit completely backwards compatible and the feature opt-in. The nonce is a type 4 UUID, which is the flavor that is randomly generated. It has 122 random bits, which should be plenty to satisfy the guarantees of a nonce.
Durham Goode - - Load All Authors

File last commit:

r25284:7072b91c default
r30766:d7bf7d2b default
Show More
patterns.txt
74 lines | 2.8 KiB | text/plain | TextLexer
/ mercurial / help / patterns.txt
History | Annotation | Raw |Copy content |Copy permalink
Mercurial accepts several notations for identifying one or more files
at a time.
By default, Mercurial treats filenames as shell-style extended glob
patterns.
Alternate pattern notations must be specified explicitly.
.. note::
Patterns specified in ``.hgignore`` are not rooted.
Please see :hg:`help hgignore` for details.
To use a plain path name without any pattern matching, start it with
``path:``. These path names must completely match starting at the
current repository root.
To use an extended glob, start a name with ``glob:``. Globs are rooted
at the current directory; a glob such as ``*.c`` will only match files
in the current directory ending with ``.c``.
The supported glob syntax extensions are ``**`` to match any string
across path separators and ``{a,b}`` to mean "a or b".
To use a Perl/Python regular expression, start a name with ``re:``.
Regexp pattern matching is anchored at the root of the repository.
To read name patterns from a file, use ``listfile:`` or ``listfile0:``.
The latter expects null delimited patterns while the former expects line
feeds. Each string read from the file is itself treated as a file
pattern.
To read a set of patterns from a file, use ``include:`` or ``subinclude:``.
``include:`` will use all the patterns from the given file and treat them as if
they had been passed in manually. ``subinclude:`` will only apply the patterns
against files that are under the subinclude file's directory. See :hg:`help
hgignore` for details on the format of these files.
All patterns, except for ``glob:`` specified in command line (not for
``-I`` or ``-X`` options), can match also against directories: files
under matched directories are treated as matched.
Plain examples::
path:foo/bar a name bar in a directory named foo in the root
of the repository
path:path:name a file or directory named "path:name"
Glob examples::
glob:*.c any name ending in ".c" in the current directory
*.c any name ending in ".c" in the current directory
**.c any name ending in ".c" in any subdirectory of the
current directory including itself.
foo/*.c any name ending in ".c" in the directory foo
foo/**.c any name ending in ".c" in any subdirectory of foo
including itself.
Regexp examples::
re:.*\.c$ any name ending in ".c", anywhere in the repository
File examples::
listfile:list.txt read list from list.txt with one file pattern per line
listfile0:list.txt read list from list.txt with null byte delimiters
See also :hg:`help filesets`.
Include examples::
include:path/to/mypatternfile reads patterns to be applied to all paths
subinclude:path/to/subignorefile reads patterns specifically for paths in the
subdirectory